Privacy Notice

• Brief and contact requests: name, business contact details, company and website, role, answers about business operations, and any information submitted in the form. Please do not submit passwords, confidential customer records, or sensitive personal information in an initial Brief request.
• Client sign-in: when an authorized client signs in with Google, Bastion OS receives the verified Google account email address and uses it to determine access to that client's organization. Client sign-in does not request access to the client's Gmail messages.
• Client workspaces: information a client or Bastion submits for an engagement, such as questions, workflow evidence, Diagnostic materials, findings, and deployment records.
• Business communications: correspondence with Bastion, including message content and delivery/reply details. Separately, authorized Bastion-owned Google Workspace mailboxes connect to Bastion OS with Gmail read and send permissions so Bastion can send approved messages, process replies, honor opt-outs, and maintain business records. These mailbox permissions are not requested from client-login accounts.
• Public business information: company websites and other public sources used to prepare evidence-backed hypotheses. Public observations are not presented as validated internal findings.
• Basic technical information needed to operate and protect the site and app, such as session and request information and security logs.

We use this information to respond to requests, research and deliver the free Operiv Brief, operate approved client workspaces, administer Diagnostics and deployments when separately agreed, communicate about Bastion services, detect misuse, honor opt-outs, and maintain records needed to operate the business. We do not treat a public-research hypothesis as a validated internal finding. We do not use Google account data for third-party advertising.

Bastion uses service providers to host the website and application, store application records, provide Google sign-in and business email, and synchronize authorized operational records. Current integrations include Webflow, Render, Neon, Google Workspace, and Notion. Other integrations, such as Apollo, Make, or Stripe, may be used when enabled for a specific workflow; this notice should be updated before any materially new use of data. Providers process information under their applicable terms. Access within Bastion is limited by role and client organization; authorized operators can access records needed to provide and support the service.

We keep information for as long as reasonably needed for the purposes above, to maintain business records, and to meet applicable obligations. No fixed deletion interval is promised here. To request access, correction, or deletion, or to ask about retention for a particular record, contact hello@getbastionprotocols.com; some records may need to be retained for legitimate business or legal reasons. To stop commercial email, reply "unsubscribe" to a Bastion outreach message. We will process opt-out requests and suppress further marketing to that address.

We use account authentication, role-based access, and technical controls to protect application data. No system is perfectly secure. This notice may change as Bastion's services and integrations change; the current version and effective date will appear on this page.